Tagged: Ebury
2 posts · browse all tags
-
Tor Deep Dive Part 1: How Over 300 Tor Exit Relays Were Hijacked to Steal SSH Passwords
In early October 2026, attackers rewrote the exit policy on hundreds of Tor relays and sent SSH traffic to interception servers. What happened, how it was found, what is still unknown, and what to change today.
-
Tor Deep Dive Part 6: Ebury, and How to Check Your Own Debian Hosts for It
Ebury is the SSH backdoor that sat on the hijacked Tor relays. How it hides inside a library sshd already loads, why dpkg -V stays silent, and what ESET's own detection script does and does not catch, tested on Debian 13.